livepro[.]ghost[.]io

This domain, livepro.ghost.io, is identified as a brand impersonation threat targeting Ledger, a hardware cryptocurrency wallet provider. The site mimics the official Ledger Live interface, a platform used for managing crypto assets, with the page title explicitly set to "Ledger Live." Such impersonation domains are commonly deployed to harvest credentials, private keys, or seed phrases, often leading to unauthorized asset transfers or crypto drainer attacks. No specific drainer kit signatures were confirmed in this instance, but the infrastructure aligns with known credential theft campaigns in the cryptocurrency sector. Analysis indicates the domain was flagged by 3 out of 95 security vendors on VirusTotal, suggesting moderate detection at the time of assessment. It was registered through 1API GmbH, a registrar frequently utilized in both legitimate and malicious operations. The domain resolves to the IP address 18.239.6.36, which has been associated with other low-reputation hosting environments. Created on October 01, 2011, the domain predates the recent surge in crypto-themed phishing but was likely repurposed for malicious use. It appears on one security blocklist, and no entries were found in Google Safe Browsing at the time of this report. The domain is currently offline, reducing immediate exposure risk to end users. However, the infrastructure remains registered and could be reactivated. Organizations and individuals are advised to monitor for renewed activity, particularly if the domain reappears under altered hosting or SSL configurations. Network defenders should update blocklists to include this domain and its associated IP address. Users who may have interacted with the site should revoke any connected wallet permissions and audit their accounts for unauthorized transactions. The elevated risk classification reflects the potential for financial loss if the domain resumes operation.